Description

Binds a PHP variable variable to the Oracle
bind variable placeholder bv_name. Binding
is important for Oracle database performance and also as a way to
avoid SQL Injection security issues.

Binding allows the database to reuse the statement context and
caches from previous executions of the statement, even if another
user or process originally executed it. Binding reduces SQL
Injection concerns because the data associated with a bind
variable is never treated as part of the SQL statement. It does
not need quoting or escaping.

PHP variables that have been bound can be changed and the
statement re-executed without needing to re-parse the statement or
re-bind.

In Oracle, bind variables are commonly divided
into IN binds for values that are passed into
the database, and OUT binds for values that are
returned to PHP. A bind variable may be
both IN and OUT. Whether a
bind variable will be used for input or output is determined at
run-time.

You must specify maxlength when using
an OUT bind so that PHP allocates enough memory
to hold the returned value.

For IN binds it is recommended to set
the maxlength length if the statement is
re-executed multiple times with different values for the PHP
variable. Otherwise Oracle may truncate data to the length of the
initial PHP variable value. If you don't know what the maximum
length will be, then re-call oci_bind_by_name()
with the current data size prior to
each oci_execute() call. Binding an
unnecessarily large length will have an impact on process memory
in the database.

A bind call tells Oracle which memory address to read data from.
For IN binds that address needs to contain
valid data when oci_execute() is called. This
means that the variable bound must remain in scope until
execution. If it doesn't, unexpected results or errors such as
"ORA-01460: unimplemented or unreasonable conversion requested"
may occur. For OUT binds one symptom is no
value being set in the PHP variable.

For a statement that is repeatedly executed, binding values that
never change may reduce the ability of the Oracle optimizer to
choose the best statement execution plan. Long running statements
that are rarely re-executed may not benefit from binding. However
in both cases, binding might be safer than joining strings into a
SQL statement, as this can be a security risk if unfiltered user
text is concatenated.

Parameters

statement

A valid OCI8 statement identifer.

bv_name

The colon-prefixed bind variable placeholder used in the
statement. The colon is optional
in bv_name. Oracle does not use question
marks for placeholders.

variable

The PHP variable to be associated with bv_name

maxlength

Sets the maximum length for the data. If you set it to -1, this
function will use the current length
of variable to set the maximum
length. In this case the variable must
exist and contain data
when oci_bind_by_name() is called.

type

The datatype that Oracle will treat the data as. The
default type used
is SQLT_CHR. Oracle will convert the data
between this type and the database column (or PL/SQL variable
type), when possible.

If you need to bind an abstract datatype (LOB/ROWID/BFILE) you
need to allocate it first using the
oci_new_descriptor() function. The
length is not used for abstract datatypes
and should be set to -1.

// oci_bind_by_name($stid, $key, $val) does not work // because it binds each placeholder to the same location: $val // instead use the actual location of the data: $ba[$key]oci_bind_by_name($stid, $key, $ba[$key]);}

// Find all cities that begin with 'South'$stid = oci_parse($conn, "SELECT city FROM locations WHERE city LIKE :bv");$city = 'South%'; // '%' is a wildcard in SQLoci_bind_by_name($stid, ":bv", $city);oci_execute($stid);oci_fetch_all($stid, $res);

For a small, fixed number of IN clause conditions, use individual
bind variables. Values unknown at run time can be set to NULL.
This allows a single statement to be used by all application
users, maximizing Oracle DB cache efficiency.

// The second procedure parameter is an OUT bind. The default type// will be a string type so binding a length 40 means that at most 40// digits will be returned.oci_bind_by_name($stid, ':p2', $p2, 40);

Return Values

Returns TRUE on success or FALSE on failure.

Notes

Warning

Do not use magic_quotes_gpc or
addslashes()
and oci_bind_by_name() simultaneously as no
quoting is needed. Any magically applied quotes will be written
into your database because oci_bind_by_name()
inserts data verbatim and does not remove quotes or escape
characters.

Note:

If you bind a string to a CHAR column in
a WHERE clause, remember that Oracle uses
blank-padded comparison semantics for CHAR
columns. Your PHP variable should be blank padded to the same
width as the column for the WHERE clause to
succeed.

Note:

The PHP variable argument is a reference. Some
forms of loops do not work as expected:

The string field is always inserting correctly w/o any truncation. The string field is a varchar2(160) CHAR, but the data used to populate it is 40 chars in length.

The numeric part is of Type Number in the database which is being used to store unix time (10 digit seconds since 1970/01/01.

The problem, the insert was truncating to 9 digits with some bogus value not even related to the input i.e., it's not just a matter of dropping the leftmost or rightmost digit, it'll just insert a 9 digit bogus number.

The only way I was able to resolve this for the numeric field was to set the maxlength to 8 (not 10 which is the number of digits in the input):

It is very important to set up the maxlength of the returning parameter (:r), even when it is returning a number, otherwise the ORA-01460 exception (unimplemented or unreasonable conversion requested) may be raised.

This is an example of returning the primary key from an insert so that you can do inserts on other tables with foreign keys based on that value. The date is just used to provied semi-unique data to be inserted.